Evaluating the utility of anonymized network traces for intrusion detection

Proceedings of the 4th International Conference on Security and Privacy in Communication Networks, SecureComm'08

Volumn , Issue , 2008, Pages

  Lakkaraju, Kiran ^a   Slagell, Adam ^b  

^a University of Illinois Urbana Champaign ^*  (United States)

^b UNIVERSITY OF ILLINOIS AT URBANA CHAMPAIGN   (United States)

Author keywords

Anonymization; Data sanitization; FLAIM; Intrusion detection; Metrics

Indexed keywords

ANONYMIZATION; ATTACK DETECTION; DATA SANITIZATION; FLAIM; INTRUSION DETECTION SYSTEMS; METRICS; RIGOROUS ANALYSIS; WORK FOCUS;

COMPUTER CRIME;

INTRUSION DETECTION;

EID: 70249116116     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1460877.1460899     Document Type: Conference Paper

References (26)

1. Argus: Qosient software. http://www.qosient.com, March 2008.
2. J. Bethencourt, J. Franklin, and M. Vernon. Mapping internet sensors with probe response attacks. In Proceedings of the 14th USENIX Security Symposium, August 2005.
3. M. Bezzi and A. Kounine. Assessing Disclosure Risk in Anonymized Datasets. In FloCon, January 2008.
4. S. Coull, C. V. Wright, F. Monrose, M. P. Collins, and M. Reiter. Playing devil's advocate: Inferring sensitive information from anonymized network traces. In Proceedings of the 14th Annual Network and Distributed System Security Symposium, February 2007.
5. S. E. Coull, C. V. Wright, A. D. Keromytis, F. Monrose, and M. K. Reiter. Taming the Devil: Techniques for Evaluating Anonymized Network Data. In NDSS '08: 15th Annual Network and Distributed System Security Symposium, February 2008.
6. L. W. Group. Flaim core user's guide, March 2008.
7. K. Hafner. Researchers yearn to use aol logs, but they hesitate. New York Times, August 23 2006.
8. rd Annual Computer Security Applications Conference, pages 87-96, Dec. 2007.
9. J. King. A Taxonomy, Model, and Method for Secure Network Log Anonymization. PhD thesis, University of Illinois, Urbana-Champaign, 2008.
10. T. Kohno, A. Broido, and K. C. Claffy. Remote physical device fingerprinting. In Proceedings of the IEEE Symposium on Security and Privacy, May 2005.
11. D. Koukis, S. Antonatos, D. Antoniades, E. Markatos, and P. Trimintzios. A Generic Anonymization Framework for Network Traffic. In ICC '06: IEEE International Conference on Communications, volume 5, pages 2302-2309, June 2006.
12. K. Lakkarau and A. Slagell. Evaluating the utility of anonymized network traces for intrustion detection. ArXiv, Dec 2008.
13. P. Lincoln, P. Porras, and V. Shmatikov. Privacy-preserving sharing and correlation of security alerts. In Proceedings of the 13th USENIX Security Symposium, August 2004.
14. R. Lippmann, J. W. Haines, D. J. Fried, J. Korba, and K. Das. The 1999 darpa off-line intrusion detection evaluation. Computer Networks, 2000.
15. J. McHugh. Testing intrusion detection systems: A critique of the 1998 and 1999 darpa intrusion detection system evaluations as performed by lincoln laboratories. ACM Transactions on Information and System Security, 3(4):262-294, 2000.
16. G. Minshall. Tcpdpriv: Program for eliminating confidential information from traces.
17. A. Narayanan and V. Shmatikov. How to break anonymity of the netflix prize dataset. In ACM Computing Research Repository, October 2006.
18. R. Pang, M. Allman, V. Paxson, and J. Lee. The devil and packet trace anonymization. Computer Communication Review, January 2006.
19. R. Pang and V. Paxson. A high-level programming environment for packet trace anonymization and transformation. In Proceedings of the AMC SIGCOMM Conference, August 2003.
20. D. Sicker, P. Ohm, and D. Grunwald. Legal issues surrounding monitoring during network research. In Proceedings of the 7th ACM SIGCOMM conference on Internet measurement, August 2007.
21. A. Slagell, K. Lakkaraju, and X. Luo. Flaim: A multi-level anonymization framework for computer and network logs. In Proceedings of the 20th USENIX Large Installation System Administration Conference, December 2006.
22. A. Slagell, Y. Li, and K. Luo. Sharing network logs for computer forensics: A new tool for the anonymization of netflow records. In Proceedings of the Computer Network Forensics Research Workshop, August 2005.
23. A. Slagell and W. Yurcik. Sharing computer network logs for security and privacy: A motivation for new methodologies of anonymization. In Proceedings of SECOVAL: The Workshop on the Value of Security through Collaboration, August 2005.
24. M. Vrable, J. Ma, J. Chen, D. Moore, E. Vandekieft, A. C. Snoeren, G. M. Voelker, and S. Savage. Scalability, fidelity, and containment in the potemkin virtual honeyfarm. In Proceedings of the 20th Symposium on Operating System Principles, October 2005.
25. J. Xu, J. Fan, M. H. Ammar, and S. B. Moon. Prefix-preserving ip address anonymization: Measurement-based security evaluation and a new cryptography-based scheme. In Proceedings of the 10th IEEE International Conference on Network Protocols, November 2002.
26. W. Yurcik and etc. Scrub-tcpdump: A multi-level packet anonymizer demonstrating privacy/analysis tradeoffs. In Proceedings of the 3rd SECOVAL Workshop, September 2007.